CVE-2024-13359 Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the addproductinputfieldstoorderitemmeta function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers...

CVE-2024-13359

CVE-2024-13359 affects Product Input Fields for WooCommerce (WordPress). All versions up to and including 1.12.0 are vulnerable to unauthenticated arbitrary file uploads due to insufficient file-type validation in add_product_input_fields_to_order_item_meta(). By default only double-extension upl...

CVE-2024-13359 Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the addproductinputfieldstoorderitemmeta function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers...

CVE-2024-13640

CVE-2024-13640 affects the WordPress plugin Print Invoice & Delivery Notes for WooCommerce. All versions up to 5.4.1 are vulnerable via the wcdn/invoice directory, enabling unauthenticated attackers to access sensitive data stored under /wp-content/uploads/wcdn/invoice (potential invoice files if...

WordPress Product Input Fields for WooCommerce plugin <= 1.12.0 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by luckybuddy in WordPress Plugin Product Input Fields for WooCommerce versions = 1.12.0...

CVE-2024-13774

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'savetomultiplewishlist' function. This makes it possible for...

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin Print Invoice & Delivery Notes for WooCommerce versions = 5.4.1...

CVE-2024-13774 Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'savetomultiplewishlist' function. This makes it possible for...

WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name vulnerability

Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name vulnerability discovered by Tim Coen in WordPress Plugin Wishlist for WooCommerce versions = 3.1.7...

WordPress plugin Print Invoice & Delivery Notes for WooCommerce 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...

CVE-2025-0956

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookieguestemail' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object...

CVE-2024-13904

CVE-2024-13904 – Platform.ly for WooCommerce (WordPress) is a confirmed SSRF vulnerability affecting all versions up to and including 1.1.6, exploitable by unauthenticated attackers via the plugin’s hooks function to make web requests from the WordPress environment to arbitrary locations, enablin...

CVE-2024-13320

The CVE-2024-13320 entry describes an SQL Injection in the CURCY - WooCommerce Multi Currency - Currency Switcher WordPress plugin. Affected component: the wc_filter_price_meta[where] parameter; root cause: insufficient escaping and lack of prepared statements in the SQL query. Impact: unauthenti...

WordPress plugin Platform.ly for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists i...

CVE-2024-13724

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...

CVE-2024-13868

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13868

CVE-2024-13868 concerns the URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin (

CVE-2025-0956

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookieguestemail' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object...

CVE-2025-0956 WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookieguestemail' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object...

CVE-2025-0956 WooCommerce Recover Abandoned Cart <= 24.3.0 - Unauthenticated PHP Object Injection

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookieguestemail' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object...